Teichlab / celltypist

A tool for semi-automatic cell type classification
https://www.celltypist.org/
MIT License
254 stars 40 forks source link

certificate verification failed when trying to load models #76

Closed maximillo closed 11 months ago

maximillo commented 11 months ago

I'm running this from within the cell2loc docker container.

Running "model = models.Model.load(model = 'Immune_All_Low.pkl')" gives me a SSL certificate verification error as follows:

SSLCertVerificationError Traceback (most recent call last) File /opt/conda/envs/cell2loc_env/lib/python3.11/site-packages/urllib3/connectionpool.py:467, in HTTPConnectionPool._make_request(self, conn, method, url, body, headers, retries, timeout, chunked, response_conn, preload_content, decode_content, enforce_content_length) 466 try: --> 467 self._validate_conn(conn) 468 except (SocketTimeout, BaseSSLError) as e:

File /opt/conda/envs/cell2loc_env/lib/python3.11/site-packages/urllib3/connectionpool.py:1092, in HTTPSConnectionPool._validate_conn(self, conn) 1091 if conn.is_closed: -> 1092 conn.connect() 1094 if not conn.is_verified:

File /opt/conda/envs/cell2loc_env/lib/python3.11/site-packages/urllib3/connection.py:635, in HTTPSConnection.connect(self) 627 warnings.warn( 628 ( 629 f"System time is way off (before {RECENT_DATE}). This will probably " (...) 632 SystemTimeWarning, 633 ) --> 635 sock_and_verified = _ssl_wrap_socket_and_match_hostname( 636 sock=sock, 637 cert_reqs=self.cert_reqs, 638 ssl_version=self.ssl_version, 639 ssl_minimum_version=self.ssl_minimum_version, 640 ssl_maximum_version=self.ssl_maximum_version, 641 ca_certs=self.ca_certs, 642 ca_cert_dir=self.ca_cert_dir, 643 ca_cert_data=self.ca_cert_data, 644 cert_file=self.cert_file, 645 key_file=self.key_file, 646 key_password=self.key_password, 647 server_hostname=server_hostname, 648 ssl_context=self.ssl_context, 649 tls_in_tls=tls_in_tls, 650 assert_hostname=self.assert_hostname, 651 assert_fingerprint=self.assert_fingerprint, 652 ) 653 self.sock = sock_and_verified.socket

File /opt/conda/envs/cell2loc_env/lib/python3.11/site-packages/urllib3/connection.py:776, in _ssl_wrap_socket_and_match_hostname(sock, cert_reqs, ssl_version, ssl_minimum_version, ssl_maximum_version, cert_file, key_file, key_password, ca_certs, ca_cert_dir, ca_cert_data, assert_hostname, assert_fingerprint, server_hostname, ssl_context, tls_in_tls) 774 server_hostname = normalized --> 776 ssl_sock = ssl_wrap_socket( 777 sock=sock, 778 keyfile=key_file, 779 certfile=cert_file, 780 key_password=key_password, 781 ca_certs=ca_certs, 782 ca_cert_dir=ca_cert_dir, 783 ca_cert_data=ca_cert_data, 784 server_hostname=server_hostname, 785 ssl_context=context, 786 tls_in_tls=tls_in_tls, 787 ) 789 try:

File /opt/conda/envs/cell2locenv/lib/python3.11/site-packages/urllib3/util/ssl.py:466, in ssl_wrap_socket(sock, keyfile, certfile, cert_reqs, ca_certs, server_hostname, ssl_version, ciphers, ssl_context, ca_cert_dir, key_password, ca_cert_data, tls_in_tls) 464 pass --> 466 ssl_sock = _ssl_wrap_socket_impl(sock, context, tls_in_tls, server_hostname) 467 return ssl_sock

File /opt/conda/envs/cell2locenv/lib/python3.11/site-packages/urllib3/util/ssl.py:510, in _ssl_wrap_socket_impl(sock, ssl_context, tls_in_tls, server_hostname) 508 return SSLTransport(sock, ssl_context, server_hostname) --> 510 return ssl_context.wrap_socket(sock, server_hostname=server_hostname)

File /opt/conda/envs/cell2loc_env/lib/python3.11/ssl.py:517, in SSLContext.wrap_socket(self, sock, server_side, do_handshake_on_connect, suppress_ragged_eofs, server_hostname, session) 511 def wrap_socket(self, sock, server_side=False, 512 do_handshake_on_connect=True, 513 suppress_ragged_eofs=True, 514 server_hostname=None, session=None): 515 # SSLSocket class handles server_hostname encoding before it calls 516 # ctx._wrap_socket() --> 517 return self.sslsocket_class._create( 518 sock=sock, 519 server_side=server_side, 520 do_handshake_on_connect=do_handshake_on_connect, 521 suppress_ragged_eofs=suppress_ragged_eofs, 522 server_hostname=server_hostname, 523 context=self, 524 session=session 525 )

File /opt/conda/envs/cell2loc_env/lib/python3.11/ssl.py:1075, in SSLSocket._create(cls, sock, server_side, do_handshake_on_connect, suppress_ragged_eofs, server_hostname, context, session) 1074 raise ValueError("do_handshake_on_connect should not be specified for non-blocking sockets") -> 1075 self.do_handshake() 1076 except (OSError, ValueError):

File /opt/conda/envs/cell2loc_env/lib/python3.11/ssl.py:1346, in SSLSocket.do_handshake(self, block) 1345 self.settimeout(None) -> 1346 self._sslobj.do_handshake() 1347 finally:

SSLCertVerificationError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: self-signed certificate in certificate chain (_ssl.c:1002)

During handling of the above exception, another exception occurred:

SSLError Traceback (most recent call last) File /opt/conda/envs/cell2loc_env/lib/python3.11/site-packages/urllib3/connectionpool.py:790, in HTTPConnectionPool.urlopen(self, method, url, body, headers, retries, redirect, assert_same_host, timeout, pool_timeout, release_conn, chunked, body_pos, preload_content, decode_content, response_kw) 789 # Make the request on the HTTPConnection object --> 790 response = self._make_request( 791 conn, 792 method, 793 url, 794 timeout=timeout_obj, 795 body=body, 796 headers=headers, 797 chunked=chunked, 798 retries=retries, 799 response_conn=response_conn, 800 preload_content=preload_content, 801 decode_content=decode_content, 802 response_kw, 803 ) 805 # Everything went great!

File /opt/conda/envs/cell2loc_env/lib/python3.11/site-packages/urllib3/connectionpool.py:491, in HTTPConnectionPool._make_request(self, conn, method, url, body, headers, retries, timeout, chunked, response_conn, preload_content, decode_content, enforce_content_length) 490 new_e = _wrap_proxy_error(new_e, conn.proxy.scheme) --> 491 raise new_e 493 # conn.request() calls http.client.*.request, not the method in 494 # urllib3.request. It also calls makefile (recv) on the socket.

SSLError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: self-signed certificate in certificate chain (_ssl.c:1002)

The above exception was the direct cause of the following exception:

MaxRetryError Traceback (most recent call last) File /opt/conda/envs/cell2loc_env/lib/python3.11/site-packages/requests/adapters.py:486, in HTTPAdapter.send(self, request, stream, timeout, verify, cert, proxies) 485 try: --> 486 resp = conn.urlopen( 487 method=request.method, 488 url=url, 489 body=request.body, 490 headers=request.headers, 491 redirect=False, 492 assert_same_host=False, 493 preload_content=False, 494 decode_content=False, 495 retries=self.max_retries, 496 timeout=timeout, 497 chunked=chunked, 498 ) 500 except (ProtocolError, OSError) as err:

File /opt/conda/envs/cell2loc_env/lib/python3.11/site-packages/urllib3/connectionpool.py:844, in HTTPConnectionPool.urlopen(self, method, url, body, headers, retries, redirect, assert_same_host, timeout, pool_timeout, release_conn, chunked, body_pos, preload_content, decode_content, **response_kw) 842 new_e = ProtocolError("Connection aborted.", new_e) --> 844 retries = retries.increment( 845 method, url, error=new_e, _pool=self, _stacktrace=sys.exc_info()[2] 846 ) 847 retries.sleep()

File /opt/conda/envs/cell2loc_env/lib/python3.11/site-packages/urllib3/util/retry.py:515, in Retry.increment(self, method, url, response, error, _pool, _stacktrace) 514 reason = error or ResponseError(cause) --> 515 raise MaxRetryError(_pool, url, reason) from reason # type: ignore[arg-type] 517 log.debug("Incremented Retry for (url='%s'): %r", url, new_retry)

MaxRetryError: HTTPSConnectionPool(host='celltypist.cog.sanger.ac.uk', port=443): Max retries exceeded with url: /models/models.json (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: self-signed certificate in certificate chain (_ssl.c:1002)')))

During handling of the above exception, another exception occurred:

SSLError Traceback (most recent call last) File /opt/conda/envs/cell2loc_env/lib/python3.11/site-packages/celltypist/models.py:38, in _requests_get(url, timeout) 37 try: ---> 38 r = requests.get(url, timeout = timeout) 39 r.raise_for_status()

File /opt/conda/envs/cell2loc_env/lib/python3.11/site-packages/requests/api.py:73, in get(url, params, kwargs) 63 r"""Sends a GET request. 64 65 :param url: URL for the new :class:Request object. (...) 70 :rtype: requests.Response 71 """ ---> 73 return request("get", url, params=params, kwargs)

File /opt/conda/envs/cell2loc_env/lib/python3.11/site-packages/requests/api.py:59, in request(method, url, kwargs) 58 with sessions.Session() as session: ---> 59 return session.request(method=method, url=url, kwargs)

File /opt/conda/envs/cell2loc_env/lib/python3.11/site-packages/requests/sessions.py:589, in Session.request(self, method, url, params, data, headers, cookies, files, auth, timeout, allow_redirects, proxies, hooks, stream, verify, cert, json) 588 send_kwargs.update(settings) --> 589 resp = self.send(prep, **send_kwargs) 591 return resp

File /opt/conda/envs/cell2loc_env/lib/python3.11/site-packages/requests/sessions.py:703, in Session.send(self, request, kwargs) 702 # Send the request --> 703 r = adapter.send(request, kwargs) 705 # Total elapsed time of the request (approximately)

File /opt/conda/envs/cell2loc_env/lib/python3.11/site-packages/requests/adapters.py:517, in HTTPAdapter.send(self, request, stream, timeout, verify, cert, proxies) 515 if isinstance(e.reason, _SSLError): 516 # This branch is for urllib3 v1.22 and later. --> 517 raise SSLError(e, request=request) 519 raise ConnectionError(e, request=request)

SSLError: HTTPSConnectionPool(host='celltypist.cog.sanger.ac.uk', port=443): Max retries exceeded with url: /models/models.json (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: self-signed certificate in certificate chain (_ssl.c:1002)')))

During handling of the above exception, another exception occurred:

Exception Traceback (most recent call last) Cell In[23], line 2 1 # Indeed, the model argument defaults to Immune_All_Low.pkl. ----> 2 model = models.Model.load(model = 'Immune_All_Low.pkl')

File /opt/conda/envs/cell2loc_env/lib/python3.11/site-packages/celltypist/models.py:90, in Model.load(model) 88 if not model: 89 model = get_default_model() ---> 90 if model in get_all_models(): 91 model = get_model_path(model) 92 if not os.path.isfile(model):

File /opt/conda/envs/cell2loc_env/lib/python3.11/site-packages/celltypist/models.py:359, in get_all_models() 350 def get_all_models() -> list: 351 """ 352 Get a list of all the available models. 353 (...) 357 A list of available models. 358 """ --> 359 download_if_required() 360 available_models = [] 361 for model_filename in os.listdir(models_path):

File /opt/conda/envs/cell2loc_env/lib/python3.11/site-packages/celltypist/models.py:372, in download_if_required() 370 if len([m for m in os.listdir(models_path) if m.endswith(".pkl")]) == 0: 371 logger.info(f"πŸ”Ž No available models. Downloading...") --> 372 download_models()

File /opt/conda/envs/cell2loc_env/lib/python3.11/site-packages/celltypist/models.py:433, in download_models(force_update, model) 417 def download_models(force_update: bool=False, model: Optional[Union[str, list, tuple]] = None) -> None: 418 """ 419 Download all the available or selected models. 420 (...) 431 To check all available models, use :func:~celltypist.models.models_description. 432 """ --> 433 models_json = get_models_index(force_update) 434 logger.info(f"πŸ“‚ Storing models in {models_path}") 435 if model is not None:

File /opt/conda/envs/cell2loc_env/lib/python3.11/site-packages/celltypist/models.py:392, in get_models_index(force_update) 390 models_json_path = get_model_path("models.json") 391 if not os.path.exists(models_json_path) or force_update: --> 392 download_model_index() 393 with open(models_json_path) as f: 394 return json.load(f)

File /opt/conda/envs/cell2loc_env/lib/python3.11/site-packages/celltypist/models.py:409, in download_model_index(only_model) 407 url = 'https://celltypist.cog.sanger.ac.uk/models/models.json' 408 logger.info(f"πŸ“œ Retrieving model list from server {url}") --> 409 response = _requests_get(url) 410 with open(get_model_path("models.json"), "wb") as f: 411 f.write(response.content)

File /opt/conda/envs/cell2loc_env/lib/python3.11/site-packages/celltypist/models.py:41, in _requests_get(url, timeout) 39 r.raise_for_status() 40 except requests.exceptions.RequestException as e: ---> 41 raise Exception( 42 f"πŸ›‘ Cannot fetch '{url}', the error is: {e}") 43 return r

Exception: πŸ›‘ Cannot fetch 'https://celltypist.cog.sanger.ac.uk/models/models.json', the error is: HTTPSConnectionPool(host='celltypist.cog.sanger.ac.uk', port=443): Max retries exceeded with url: /models/models.json (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: self-signed certificate in certificate chain (_ssl.c:1002)')))

maximillo commented 11 months ago

Reseting the "models.models_path" to current path and manually download the files to the directory bypasses this problem. Alternatively, download the models to "/root/.celltypist/data/model" (the default models.models_path) directory will also do.

prete commented 11 months ago

As a side note, that can be controled using the CELLTYPIST_FOLDER environment variable rather than modifying models.models_path directly. ie:

export CELLTYPIST_FOLDER="/some/path"

and you could pass that to the continer you're launching before you start to pick your prefered location.